Add http_raw_header as an alias to the http_header keyword as that actually inspects the raw headers (see issue #243). Closes issue #242.

src/detect-http-header.c

@@ -21,6 +21,8 @@
  * \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
  *
  * Implements support for the http_header keyword
+ *
+ * \todo this is actually the raw match
  */
 
 #include "suricata-common.h"
@@ -74,6 +76,23 @@ void DetectHttpHeaderRegister(void)
     sigmatch_table[DETECT_AL_HTTP_HEADER].flags |= SIGMATCH_PAYLOAD ;
 }
 
+/**
+ * \brief Registers the keyword handlers for the "http_raw_header" keyword.
+ */
+void DetectHttpRawHeaderRegister(void)
+{
+    sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].name = "http_raw_header";
+    sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].Match = NULL;
+    sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].AppLayerMatch = DetectHttpHeaderMatch;
+    sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].alproto = ALPROTO_HTTP;
+    sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].Setup = DetectHttpHeaderSetup;
+    sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].Free  = DetectHttpHeaderFree;
+    //sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].RegisterTests = DetectHttpHeaderRegisterTests;
+    sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].RegisterTests = NULL;
+
+    sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].flags |= SIGMATCH_PAYLOAD ;
+}
+
 /**
  * \brief App layer match function for the "http_header" keyword.
  *

src/detect-http-header.h

@@ -38,5 +38,6 @@ typedef struct DetectHttpHeaderData_ {
 } DetectHttpHeaderData;
 
 void DetectHttpHeaderRegister(void);
+void DetectHttpRawHeaderRegister(void);
 
 #endif /* __DETECT_HTTP_HEADER_H__ */

src/detect.c

@@ -3718,6 +3718,7 @@ void SigTableSetup(void) {
     DetectUrilenRegister();
     DetectDetectionFilterRegister();
     DetectHttpHeaderRegister();
+    DetectHttpRawHeaderRegister();
     DetectHttpClientBodyRegister();
     DetectHttpUriRegister();
     DetectAsn1Register();

src/detect.h

@@ -876,6 +876,7 @@ enum {
     DETECT_AL_URILEN,
     DETECT_AL_HTTP_CLIENT_BODY,
     DETECT_AL_HTTP_HEADER,
+    DETECT_AL_HTTP_RAW_HEADER,
     DETECT_AL_HTTP_URI,
     DETECT_AL_HTTP_STAT_MSG,
     DETECT_AL_HTTP_STAT_CODE,